Every type of Molten Salt Reactor has strong inherent safety, and excellent passive safety features. Inherent safety is from physics and chemistry, and passive safety is from engineering. Passive safety features require no electricity or operator intervention, for the safety features to work.
Passive Safety: Drain Fuel in Emergency
If the reactor overheats, a frozen plug melts and the fuel quickly drains out of the core into tanks where ongoing nuclear reaction is physically impossible. Radioactive materials are contained by materials that remain solid at temperatures much higher than ever inside the reactor. Passive air cooling is sufficient, indefinitely. (In solid-fueled reactors, you have to override everything that normally happens in the core and bring in coolant.)
Fuel draining to the storage tanks could also be triggered by seismic alert, chemical or temperature sensors, power outage to the reactor, or the operators. [The 1989 Loma Prieta earthquake about 60 miles from Oakland, CA, reached Oakland about 30 seconds later. Japan has a seismic alert network, industrial plants shut down, elevators open at the nearest floor, trains stop, surgeons are alerted, etc. California is building one.]
“LFTR designs have a freeze plug at the bottom of the core — a plug of salt, cooled by a fan to keep it at a temperature below the freezing point of the salt. If temperature rises beyond a critical point, the plug melts, and the liquid fuel in the core is immediately evacuated, pouring into a subcritical geometry in a catch basin. This formidable safety tactic is only possible if the fuel is a liquid.” Hargraves, American Scientist, July 2010 [“subcritical geometry = the shape of the container ensures there won’t be ongoing fission]
“A passive core drain system activated by a melt plug enables draining the radioactive inventory into geometrically subcritical drain tanks that are passively thermally coupled to the environment.” Fast Spectrum Molten Salt Reactor Options, Oak Ridge National Laboratory, July 2011
“One of the current requirements of the Nuclear Regulatory Commission (NRC) for certification of a new nuclear plant design is that in the event of a complete electricity outage, the reactor remain at least stable for several days if it is not automatically deactivated. As it happens, the freeze-plug safety feature is as old as Alvin Weinberg’s 1965 Molten Salt Reactor Experiment design, yet it meets the NRC’s requirement; at ORNL, the [engineers] would routinely shut down the reactor by simply cutting the power to the freeze-plug cooling system. This setup is the ultimate in safe poweroutage response. Power isn’t needed to shut down the reactor, for example by manipulating control elements. Instead power is needed to prevent the shutdown of the reactor.” Hargraves, American Scientist, July 2010
Inherent Safety: Low Pressure
LFTRs operate at atmospheric pressure. No high pressure to contain, no risk of pressure containment explosively failing. In any design of Molten Salt Reactor, there is no coolant boiling away.
“A signature safety feature of the LFTR design is that the coolant — liquid fluoride salt — is not under pressure. The fluoride salt does not boil below 1400 degrees Celsius. Neutral pressure reduces the cost and the scale of LFTR plant construction by reducing the scale of the containment requirements, because it obviates the need to contain a pressure explosion. Disruption in a transport line would result in a leak, not an explosion, which would be captured in a noncritical configuration in a catch basin, where it would passively cool and harden.” Hargraves, American Scientist Volume 98, July 2010
“Only a low pressure vessel is needed as the salts run near atmospheric pressure as opposed to the thick walled vessels needed for LWR or PBMR. No water or sodium means no possible steam explosion or hydrogen production within the containment. In designs without graphite moderator, there is not even combustible material present.” D. LeBlanc / Nuclear Engineering and Design 240 (2010) p.1644-1656
“The containment walls are only required to contain a low-pressure internal environment and endure when subjected to external seismic and impact stressors. Halide salts are chemically inert, so they do not have exothermic reactions with the environment (oxygen, water) as would hot sodium or hot zirconium. With a greater than 500°C margin to boiling, the halide salts also do not have a credible route to pressurizing containment as would a water-cooled reactor. FS-MSRs also do not have any hydrogenous material within containment; thus they cannot generate hydrogen.” Fast Spectrum Molten Salt Reactor Options, Oak Ridge National Laboratory, July 2011
Inherent Safety: Containing Radioactive Material
Radioactive cesium and iodine that were released in Fukushima-Daiichi would not be released in a LFTR accident. Cesium fluoride, and strontium bi-fluoride, are very stable salts.
“Fluoride combines ionically with almost any transmutation product. This is an MSFR’s first level of containment. It is especially good at containing biologically active ‘salt loving’ wastes such as Cesium 137. The salts do not burn, explode or degrade in air or water, and the fluoride salts of the radioactive actinides and fission products are generally not soluble in water or air.” Wikipedia
There are much less fissile materials (compared with LWR) in the fuel salt at any time, as continuous refueling enables operating with just enough to sustain reactivity. About half of the total fissile material is in the reactor core, the rest in the heat transfer and chemical processing loops. Thorium is one of the least radioactive materials, so (unless the MSR is for waste burning, at a high security storage site) there is no hazardous fuel storage.
Gaseous fission byproducts are easily and continuously removed from the reactor and safely stored (and have short half-lives, so are below background radiation levels quickly). There is far less radioactive gas present (that could leak in an accident) than in a LWR, and it isn’t under high pressure, so there is very low risk of it leaking.
Inherent Safety: Self-Regulating
The temperature in any Molten Salt Reactor is self-regulating. The liquid fuel naturally expands if it gets hotter, slowing nuclear reaction, and contracts if it gets cooler (strong negative temperature coefficient of reactivity). [The nuclear reaction in the poorly-designed Chernobyl reactor got Hotter and Stronger as coolant boiled away.] Remove less heat (for example, making less electricity), and the reactor throttles down. Remove more heat (making more electricity) and the reactor throttles up.
“Most MSR designs have very strong negative temperature and void coefficients which act instantly, aiding safety and allowing automatic load following operation.” D. LeBlanc / Nuclear Engineering and Design 240 (2010) 1644-1656
Gaseous fission products are easily removed from the molten salt, making the reactor much more stable. (Xenon gas in LWR absorbs neutrons so readily it affects fission rate, so restarting the LWR must be done very carefully.)
“Removing the most significant neutron poison xenon-135 made the reactor safer and easier to restart. In solid-fuel reactors, on restart the 135Xe in the fuel absorbs neutrons, followed by a sudden jump in reactivity as the 135Xe is burned out. Conventional reactors may have to wait hours until xenon-135 decays after shutting down and not immediately restarting.” Wikipedia – Molten Salt Reactor Experiment
“The MSRE confirmed expectations and predictions. For example, it was demonstrated that: the fuel salt was immune to radiation damage, the graphite was not attacked by the fuel salt, and the corrosion of Hastelloy-N was negligible. Noble gases were stripped from the fuel salt by a spray system, reducing the 135Xe poisoning by a factor of about 6. The bulk of the fission product elements remained stable in the salt. Additions of uranium and plutonium to the salt during operation were quick and uneventful, and recovery of uranium by fluorination was efficient.” Wikipedia – Molten Salt Reactor Experiment
Inherent Safety: Meltdowns Impossible
Beyond the obvious “the fuel is already molten”, fuel melting through the reactor vessel is not possible. In a Molten Salt Reactor, the fuel is dissolved in and chemically bonded to the cooling salt, a low-viscosity liquid. Even if the circulation stops (e.g. pump failure or electricity isn’t available), or if heat exchange fails, the fuelsalt temperature is always far below the melting temperature of the reactor materials. Thermal expansion/contraction of the fuelsalt strongly regulates the fission rate, keeping the temperature very steady. There are no normal or accident conditions that could increase the temperature of the fuelsalt to the melting point of the reactor materials.
If some pipe breaks, the low-pressure fuelsalt would spill, no pressure to make it explode. The spill would quickly cool to a solid, that doesn’t dissolve in water, doesn’t react to air or water, and is too dense to be carried in the air. Any spill would be easy to gather, far easier than the radioactive materials carried in water at Fukushima; easier than a coal ash spill dissolving toxic waste in water.
In LWR, the temperature inside the fuel pellets during operation, is much higher than the reactor materials can withstand. If the pellets and cladding aren’t continuously cooled, the uranium oxide fuel pellets will melt, then melt through the reactor vessel. Cooling in LWR must continue after shutdown, until the fuel has cooled substantially.
In MSR, the fuel and salt are chemically bonded, and chemically stable; the fuel doesn’t get more dense unless it can spread out to cool (fission stops except in specific geometries, sphere or cylinder of sufficient diameter).
Inherent Safety: Stable Chemistry
“FS-MSRs have a negative salt void coefficient (expanded fuel is pushed out of the core) and a negative thermal reactivity feedback that avoids a set of major design constraints in solid-fuel fast reactors. A passive core drain system activated by a melt plug enables draining the radioactive inventory into geometrically subcritical drain tanks that are passively thermally coupled to the environment. FS-MSRs have a low operating pressure even at high temperatures; and FS-MSR salts are chemically inert, thermodynamically lacking the energetic reactions with environmental materials seen in other reactor types (hot zirconium and sodium with water). FS-MSRs do involve more intensive manipulation of highly radioactive materials than other reactor classes and thus small spills and contamination accidents appear to be more likely with this reactor class.” Fast Spectrum Molten Salt Reactor Options, Oak Ridge Nat’l Lab 2011
[“Energetic reactions” e.g. sodium explodes in contact with water. Yet sodium-cooled reactors, with several tons of sodium, usually have heat exchanger equipment to transfer heat to conventional steam turbines! The Monju Nuclear Power Plant in Japan, a sodium-cooled fast breeder reactor, was heavily damaged by a sodium explosion. “Fortunately, the leak occurred in the plant’s secondary cooling system, so the sodium was not radioactive.” It has not resumed operation.]
People hear “fluorine” (or chlorine), and think that is very chemically reactive, but as salts (fluoride or chloride) they are very stable. Every type of salt reacts with some metals, especially at high temperatures, but there are metals that corrode very slowly with each salt that could be used. There are already materials certified and demonstrated for low corrosion with FLiBe salt for decades of operation, and other materials that should work better (e.g. at higher temperatures or for more years) to be tested. Fast Spectrum Molten Salt Reactor Options, Oak Ridge Nat’l Lab 2011 has some discussions of the salts and metals that could be used, even in the higher temperature and higher radiation of a fast-spectrum molten salt reactor.